CVE-2020-9934

CVE-2020-9934 is an input validation flaw in the way Apple operating systems handled environment variables, which could allow a local user to view sensitive user information. It is triggered by a local attacker or user with limited privileges running code or commands on a vulnerable device, where the mishandled environment variables leak data. Successful exploitation results in disclosure of confidential information only, with no impact on data integrity or availability per the CVSS scoring. It affects devices running iOS or iPadOS versions before 13.6 and macOS Catalina versions before 10.15.6. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-08, confirming exploitation in the wild, though no public proof-of-concept is known.

What to do: Upgrade affected devices to iOS 13.6 / iPadOS 13.6 or later, and macOS Catalina systems to 10.15.6 or later, as required by CISA's KEV listing. Because exploitation requires local access, restrict local user accounts on shared Macs and iOS devices and review who can execute code on them. Use MDM or endpoint inventory to confirm fleet-wide patch levels against these minimum versions.